EN
ESThe 'Prove You're Human' Box Is the Attack: ClickFix and the Malware Your Employees Install Themselves
Most of the break-ins my team cleans up start the same way: a piece of software nobody got around to patching. This one is different. There's nothing to patch — because the victim does all the work themselves, and the whole time they think they're just proving they're not a robot.
It's called ClickFix, and in 2026 it has quietly become one of the most common ways attackers get their first foot in the door. No exploit. No zero-day. Just a fake little "verification" box and a moment of trust.
⚡ The 60-Second Version
- What: A social-engineering trick called ClickFix. A fake "verify you're human" or "fix this error" page walks your employee through copying and running a command — and that command quietly installs malware, usually a password-and-cookie stealer. There is no software flaw involved; it abuses habit and trust. Researchers tracked a surge of more than 500% in these attacks through 2025, and it's now a leading way intrusions begin.
- Fix: Teach one hard rule — a legitimate website will never ask you to press Windows+R (or open Terminal) and paste something in. Back it up with modern endpoint protection in block mode and by locking down the Run dialog and PowerShell for everyday users.
- By when: Now. This isn't tied to a patch deadline — it's running every single day. As I write this in mid-July 2026, there's an active campaign using ClickFix-poisoned websites to spread a new data-stealing malware called TELEPUZ.
What ClickFix actually is
Picture one of your employees searching for how to fix a printer, or clicking a link to open a shared document. A page pops up that looks completely ordinary — a "verify you are human" checkbox, or a "your browser needs a quick fix to view this content" message.
Then it gives friendly, step-by-step instructions: press the Windows key and R together, then press Ctrl+V, then hit Enter. It might frame this as "completing the CAPTCHA" or "running the verification."
Here's the trick. The moment the page loaded, it silently copied a command onto your employee's clipboard. Windows+R opens the Run box — a direct line to the computer's command engine. Ctrl+V pastes the hidden command. Enter runs it. In about four seconds, without downloading anything they'd recognize as a program, your employee has told their own PC to reach out to the attacker's server and pull down malware.
The technique was first named by security researchers back in 2024. It works because it doesn't fight your defenses — it borrows your employee's hands. They're not being careless; they're being cooperative, which is exactly what makes it so effective.
Why it slips past the protections you already paid for
This is the part I want business owners to sit with, because it upends a comfortable assumption.
There is no patch for ClickFix. Your firewall is fine. Your servers are up to date. The attacker never touched a vulnerability. The malware runs with your employee's own permissions because your employee ran it. Many traditional antivirus tools wave it through for the same reason — the "Run" command looks like normal user activity, not an attack.
And the payload is designed to hurt. The malware these campaigns drop — families with names like Lumma Stealer, StealC, and NetSupport — are infostealers. In seconds they scrape saved passwords out of the browser, copy cryptocurrency wallet data and VPN settings, and — this is the one that stings — grab active session cookies.
A session cookie is the little token your browser holds that says "this person already logged in." If an attacker steals a valid one for Microsoft 365 or your bank, they can sometimes slip straight into the account without ever facing the multi-factor prompt, because as far as the system is concerned, that login already happened. MFA is essential — I've written about it plenty — but this is a reminder that a stolen session can sometimes step around it.
It's not just a Windows problem
For a while, Mac owners felt safe here. Not anymore. Attackers have built ClickFix pages that target macOS users looking for help with system issues, walking them through pasting a command into Terminal instead of the Run box. The payloads — infostealers like AMOS and MacSync — do the same kind of damage.
The good news: Apple added a built-in guardrail in macOS 26.4 that warns you when something suspicious is about to be pasted into Terminal. If your Macs are on an older version, that safety net isn't there yet — another reason to keep them current.
What this means for your business
You don't need to be technical to shut most of this down. Here's what I'd do this week, in order:
- Teach the one rule. Say it in your next team huddle: no real website, ever, asks you to press Windows+R or open Terminal and paste a command. If a page asks for that, close it and tell IT. That single sentence stops the whole attack.
- Make it a "when in doubt, ask" culture. Your people should feel safe flagging a weird page without fear of looking silly. The ones who report are protecting everyone.
- Turn on real endpoint protection (EDR) in blocking mode. Modern tools catch the command behavior even when the file looks clean. This is the safety net for the moment training fails.
- Lock down the tools attackers borrow. Everyday user accounts rarely need PowerShell or the Run dialog. Restricting them removes the very lever ClickFix pulls.
- Assume passwords can leak, and plan for it. Use phishing-resistant MFA where you can, keep a password manager instead of browser-saved logins, and know how to force-log-out sessions if a laptop is compromised.
How BVTech helps
For our managed clients, most of this is already handled quietly in the background — endpoint protection in block mode, hardened user accounts, and the monitoring that catches a stolen-session login before it becomes a bad week. We also fold "ClickFix" and its cousins into the security awareness training we run, because the strongest firewall you own is a well-briefed team.
If you're not sure whether your business could stop an employee from pasting a command into their own PC — or you'd just like a second set of eyes — that's exactly the kind of thing we're here for. You can book a call or take a look at our cybersecurity services. Curious where you stand right now? Our Security Scoreboard is a good, no-pressure place to start.
Stay careful out there. The scams keep getting friendlier — that's the whole point.
— Jordan Polasek · Founder, BVTech LLC